TlgRegisterAggregateProviderEx

INT64 __stdcall TlgRegisterAggregateProviderEx(PVOID CallbackContext){
  __int64 v1; 
  __int64 v2; 
  __int64 v3; 
  __int64 v5; 
  CHAR *TlgAggregateSession; 
  CHAR *v7; 
  int v8; 
  _BYTE *v9; 
  _BYTE *v10; 
  INT64 v11; 
  INT64 *v12; 
  char v13; 
  v3 = v1;
  v5 = v2;
  TlgAggregateSession = CreateTlgAggregateSession(0, 1);
  v7 = TlgAggregateSession;
  if( !TlgAggregateSession )
    return TraceLoggingRegisterEx_EtwRegister_EtwSetInformation(CallbackContext);
  *((_QWORD *)TlgAggregateSession + 41) = v3;
  *((_QWORD *)TlgAggregateSession + 42) = v5;
  *((_QWORD *)TlgAggregateSession + 43) = CallbackContext;
  TlgAggregateSession[373] = 0;
  *((_DWORD *)TlgAggregateSession + 92) = ComputeFlushPeriod((UINT64)TlgAggregateSession);
  v8 = TraceLoggingRegisterEx_EtwRegister_EtwSetInformation(CallbackContext);
  if( v8 < 0 )
  {
    DestroyAggregateSession(v7);
    return(unsigned int)v8;
  }
  else
  {
    LODWORD(v9) = KeAbPreAcquire(&qword_140CDB268, 0i64, 0i64);
    v10 = v9;
    if( _interlockedbittestandset64((volatile signed __int32 *)&qword_140CDB268, 0i64) )
      ExfAcquirePushLockExclusiveEx(&qword_140CDB268, v9, &qword_140CDB268);
    if( v10 )
      v10[26] |= 1u;
    v11 = qword_140CF47A0;
    if( !qword_140CF47A0 )
    {
      TraceLoggingRegisterEx_EtwRegister_EtwSetInformation(&dword_140C04750);
      v11 = qword_140CF47A0;
    }
    v12 = &qword_140CF47A0;
    while( v11 )
    {
      if( *(PVOID *)(v11 + 344) == CallbackContext )
        goto LABEL_14;
      v12 = (INT64 *)(v11 + 352);
      v11 = *(_QWORD *)(v11 + 352);
    }
    *v12 = (INT64)v7;
LABEL_14:
    v13 = _InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140CDB268, 0xFFFFFFFFFFFFFFFFui64);
    if( (v13 & 2) != 0 && (v13 & 4) == 0 )
      ExfTryToWakePushLock((volatile INT64 *)&qword_140CDB268);
    KeAbPostRelease(&qword_140CDB268);
    return 0i64;
  }
}

Referenced by: